generated: '2026-07-31'
method: searched
source: live probes of every apis.yml + OpenAPI servers[] host
note: >-
  portal.moloco.cloud is a single-page app whose catch-all returns HTTP 200 with an HTML shell for every
  /.well-known/* path probed. Those responses are recorded as false positives and are NOT treated as hits.
hosts:
- host: https://api.moloco.cloud
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: moloco-oauth-authorization-server.json
    spec: RFC 8414
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-protected-resource
    status: 404
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://mcp.moloco.cloud
  documents:
  - path: /.well-known/oauth-protected-resource/mcp
    status: 200
    content_type: application/json
    file: moloco-mcp-oauth-protected-resource.json
    spec: RFC 9728
  - path: /.well-known/oauth-protected-resource
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  - path: /.well-known/mcp.json
    status: 404
- host: https://www.moloco.com
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://developer.moloco.cloud
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/mcp.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://mcm-docs.moloco.com
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
- host: https://portal.moloco.cloud
  spa_catch_all: true
  documents:
  - path: /.well-known/security.txt
    status: 200
    content_type: text/html
    accepted: false
    reason: SPA catch-all returned the app shell, not a security.txt
  - path: /.well-known/openid-configuration
    status: 200
    content_type: text/html
    accepted: false
    reason: SPA catch-all returned the app shell, not OIDC discovery JSON
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: text/html
    accepted: false
    reason: SPA catch-all returned the app shell
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: text/html
    accepted: false
    reason: SPA catch-all returned the app shell
  - path: /.well-known/api-catalog
    status: 200
    content_type: text/html
    accepted: false
    reason: SPA catch-all returned the app shell
findings:
  security_txt: false
  openid_configuration: false
  oauth_authorization_server: true
  oauth_protected_resource: true
  api_catalog: false
  ai_plugin: false
  agent_card: false